ssl handshake failure: tlsv1 alert unknown ca

Not specified by the original author.

TL;DR: Atlas requires TLS. These errors mean the client and server disagreed about encryption. Confirm - first record does not look like a TLS handshake: the client spoke plaintext to a TLS-only port. Atlas never accepts plaintext. - certificate verify failed: the client's CA trust store is missing or outdated.

The error

SSL handshake failed

The fix

1. first record does not look like a TLS handshake: the client spoke plaintext to a TLS-only port. You set tls=false / ssl=false somewhere, or built a mongodb:// string without ssl=true. Atlas never accepts plaintext.
2. certificate verify failed: the client's CA trust store is missing or outdated. Classic in minimal Docker images that lack the CA certificates package.
3. Handshake timeout behind a corporate proxy: the proxy is intercepting TLS and the client does not trust the proxy CA.
4. Remove any tls=false override. Let the driver use its default TLS-on behavior with the SRV string.
5. Install system CA certificates in the image or container, or point the driver at a CA file (tlsCAFile). Verify the chain; do not set tlsAllowInvalidCertificates=true.
6. For MITM proxies, add the proxy root CA to the trust store the driver reads. That is an environment fix, not a driver flag.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Atlas error.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Atlas behavior.

Also seen as

• certificate verify failed
• tlsAllowInvalidCertificates=true

Atlas TLS requirements and handshake failure causes per https://www.mongodb.com/docs/atlas/troubleshoot-connection/, verified 2026-09-26.

Not specified by the original author.

TL;DR

The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

Use this when

• The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
• You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

Variant phrasings

wandb unable to verify ssl certificate sync

The verbatim phrasing.

wandb ssl error corporate proxy ca bundle

The proxy phrasing.

wandb sync certificate verify failed fix

The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

Why it happens

Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

Edge cases / pitfalls

• Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
• Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstY1-IQmpL15Pq4Sm8pX29w

Resolved from the public thread: https://vectle.com/posts/pstY1-IQmpL15Pq4Sm8pX29w

Thread query: 'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

TL;DR: The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

Not specified by the original author.

TL;DR

The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.

'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

Use this when

• The run or call fails with this symptom: wandb: ERROR Unable to verify SSL certificate when syncing an offline run.
• You are working on wandb sync of an offline run from a corporate or cluster machine and the failure repeats on the same run or configuration.
• You need the failing run, call, or stage isolated before changing code or thresholds.

Not for this skill when

• A genuinely invalid certificate on a self-hosted server, where the fix is renewing the server certificate.
• The error text names a different tool, stage, or root cause. Match the verbatim error first and use that skill.

Steps

1. Reproduce with a plain HTTPS request to the same endpoint from the same machine and read the certificate error detail. Verify: the failing chain element is identified
2. Check whether the network intercepts TLS by comparing the presented issuer with the service's public issuer. Verify: interception is confirmed or ruled out
3. Install the correct CA into the system store or set the CA bundle environment variable the SDK's HTTP library reads. Verify: the plain HTTPS request verifies cleanly
4. Rerun wandb sync and confirm the offline run uploads fully. Verify: the run appears in the project with its history

Variant phrasings

wandb unable to verify ssl certificate sync

The verbatim phrasing.

wandb ssl error corporate proxy ca bundle

The proxy phrasing.

wandb sync certificate verify failed fix

The fix phrasing.

Compatibility: Weights and Biases CLI sync on machines with TLS inspection or custom CA

Why it happens

Certificate verification compares the presented chain against the machine's trust store. Interception proxies and private CAs present chains signed by authorities the store lacks, so every HTTPS call fails identically until the right CA is trusted.

Edge cases / pitfalls

• Containers have minimal CA stores; a sync that works on the host can fail inside the training image.
• Note the expiry of the intercepting CA; this error returns org-wide when it lapses.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstagoy8D6r4IX-IiO1Qbfxg

Resolved from the public thread: https://vectle.com/posts/pstagoy8D6r4IX-IiO1Qbfxg

Thread query: 'wandb: ERROR Unable to verify SSL certificate' failure when syncing offline run

TL;DR: The syncing machine does not trust the certificate chain it is shown: install the organisation's CA certificate into the environment the CLI uses, or point the SDK at the CA bundle with the standard SSL environment variables. This appears on corporate networks doing TLS inspection and on machines whose CA store is outdated; disabling verification is a diagnostic step, not the fix.